11

Quick guess: You've upgraded the OS and the system has been up for a very long time, or managed to upgrade it without replacing the kernel, because the 4.4.11-v7+ modules have already been removed from Raspbian. If there is no such directory as /lib/modules/4.4.11-v7+ (look) you should run sudo apt update then sudo apt upgrade to ensure your kernel has been ...


7

You likely don't have issues with iptables, unless you installed and configured it as it is not running on a default Raspbian install. Also the default install will normally open and listen on the required ports. However, if you intend on running a mail server you should install and configure a firewall first, as your server will be a prime target for ...


5

iptables -F iptables -X should do the trick of cleaning your current setup, or you may use the particular chain name you don't like: iptables -F INPUT I'd recommend to add these commands at the top of your script issuing iptables commands, so every time you start from a known situation. Also, could you please elaborate more about what is your goal? the ...


5

The iptables "rules" commands in secure-rmc are very simplistic: logger -t iptables "Configuring ip tables for interface $IFACE" if [ "$IFACE" != "lo" ]; then NETMASK=$(get_subnet $IFACE) iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT iptables -A INPUT -i $IFACE -j DROP fi (get_subnet is a function that extracts the subnet of interface $...


5

Right at the top of the raspmc homepage it says: The firewall that we added in the release can now be enabled and disabled via Raspbmc Settings. They claim elsewhere the firewall is iptables and the system is debian based, so if you can't find Settings or it doesn't work, look thru the list returned by service --status-all for "iptables". If it's ...


5

I did some informal testing with a RPi in bridged, routed and NAT configurations using a usb wifi adapter to connect clients to the RPi, and the wired 100 Mbps Ethernet to my Internet router. Connecting directly to the router with wifi, I get 60 Mbps download speeds. With the RPi in the path, it drops to 10 Mbps or less. This was without any iptables ...


5

First, you went about this the wrong way. If you had simply disabled the service (update-rc.d -f dphys-swapfile) instead, it would be much easier to fix. You could also have just added swapoff --all dphys-swapfile swap off To /etc/rc.local. Next, I want you to read this, and if you then are not convinced that the unfounded and absurd concerns about ...


5

It is a bit unclear how do you want to connect the Laptop to the Raspberry Pi. I will assume that there is no other wifi router as access point running for example to connect to the internet so you want to connect to the RasPi direct by wifi. You tagged a bridge so it is possible to bridge the wired interface eth0 to wifi interface wlan0. If you setup the ...


5

One of those days ... although the pi was recently booted, it seems that it needed a reboot - probably after some update? When I was troubleshooting, I had ls /lib/modules/$(uname -r) ls: cannot access '/lib/modules/4.19.93-v7+': No such file or directory After more research, I figured maybe a reboot was required, after that I had # uname -r 4.19.97-v7+ #...


4

You have to initalize your hostapd interface on e.g. wlan0. After that you can bring up your wlan1 and connect it to your router. Now you can bridge wlan0 and wlan1 like this: apt-get install bridge-utils brctl addbr bridge0 brctl addif bridge0 wlan0 brctl addif bridge0 wlan1 ifconfig bridge0 up You can assign an ip to that bridge with: dhclient bridge0 ...


4

You're going to have to change your default routes. route del default route add default gw [WAN gateway/Internet-connected router IP address] [interface] For example: My internet router's IP address is 192.168.1.1 and it's connected to eth1 on the Pi. route del default route add default gw 192.168.1.1 eth1 Don't forget to enable IPV4 (or V6) packet ...


4

Cracked it. TLDR: Use this line: tcpflags = syn instead of this : tcpflags = syn,ack Long story: I found it useful when debugging to run the knockd daemon in interactive mode: sudo service knockd stop sudo knockd -D -v This way the daemon runs in the foreground and prints its configuration and then real-time status messages. I then tried ...


4

The problem got solved by using the following commands: sudo apt-get install ufw sudo ufw allow 22 sudo ufw allow 8090 sudo ufw allow 8092 sudo ufw enable sudo reboot And everything was just fine. Also there was just also a little issue with the web app's splash page. I thank everyone for all recommendations and answers! I will upvote what I can! Thanks ...


4

If you want a more robust setup, you can try pi-hole. It is an open source software package made to block ads network wide, specifically for a Raspberry Pi. Although it can also run on other platforms. It comes with a management interface and easy updating of the used lists.


4

Your process is listening on IPv6 address ::1 (that's the IPv6 equivalent of IPv4 127.0.0.1 (aka localhost)). You need it to listen on :: (which is IP6ADDR_ANY as that's the IPv6 equivalent of IPv4 INADDR_ANY (0.0.0.0)). Don't use nc -l localhost 5001 If you want to connect from any other machine on your LAN. Use nc -l -p 5001 or nc -l -6 -p 5001 or nc -...


3

I would like to block all scanners Then disconnect it from the internet. You cannot have it accessible on any port and still hide it from a scanner. The only way to hide it from a scanner and have it online would be to just set: iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP And nothing else. In which case there is no point in ...


3

Change the vpn configs to both have dev tun and change your iptables to use: *mangle :PREROUTING ACCEPT :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT COMMIT *raw :PREROUTING ACCEPT :OUTPUT ACCEPT COMMIT *nat :PREROUTING ACCEPT :INPUT ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT -A POSTROUTING -o tun0 -j MASQUERADE COMMIT *filter :INPUT ...


3

It's not recommended to mess around with a process' affinity. If you really have the urge, use taskset but you have been warned. The best you might do is kill people hurt performance (sic). What I'd recommend is simply fire up multiple instances of OpenVPN, using different configuration files. You'll want to do something along the lines of /usr/local/sbin/...


3

You can make firewall rules like this; iptables --flush iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -s 192.168.0.0/24 -d 0/0 -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j REJECT ...


3

Why use iptables at all if you want a ssh reverse tunnel? Use ssh -g -f -N -T -R22222:192.168.1.192:80 user@myvps.com Assuming that 192.168.1.192:80 is the address of your camera and port 22222 is the port to listen on the remote server. No iptables, no forwarding needed for this. You may need to allow the option -g on the server, see sshd_config, set ...


3

I've found a solution and created a script to share it. This script will download a list of known domains and block them by using dnsmasq. Those lists will be updated daily. Run ./adblocker.sh --install|--start|--stop to install, start or stop it. The script: #!/bin/bash installAB () { if [[ "$(crontab -l | grep adblocker.sh)" =~ adblocker.sh ]]; then ...


3

I've solved the problem. UPDATE: The main issue appears to be in the kernel drivers. Problem solved by upgrading the kernel from 4.14.50-v7+ to the latest stable version (currently 4.14.79-v7+) using sudo apt-get install raspberrypi-kernel, and rebooting. The steps outlined below are no longer necessary. (reference). UPDATE 2: Bad drivers on the client ...


2

I found that this command will give you the IP address only: $ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' To output it to a file: $ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' > "/var/www/ipadress.txt"


2

The newer Fedora versions (after 18) use firewalld as a default solution instead of iptables. So all the configuration files are in /etc/firewalld You can read extensively about firewalld configuration options here . Since you effectively want to stop the firewall service just do systemctl stop firewalld.service or to make it permanent systemctl disable ...


2

Goldilocks solution did not work for me. But here is my solution : I added this line to the end of the /etc/network/if-up.d/secure-rmc : sudo /sbin/iptables --flush


2

You want to use "DNAT" for this. You do DNAT in the PREROUTING nat table. Probablly something along the lines of iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <destination ip>


2

As it turns out, I was really close to getting it right. Thanks to the awesome guys over at the raspberry pi forum, I got it working. What I did was changing the gateway on the pi zero to the ip of the pi 2: allow-hotplug usb0 iface usb0 inet static address 10.0.1.2 netmask 255.255.255.0 gateway 10.0.1.1 #<-- I changed this And ...


2

You may be able to create a network bridge. This essentially lets your Pi act as a network switch between the Wi-fi and wired networks. sudo apt-get install bridge-utils sudo ifconfig eth0 0.0.0.0 sudo ifconfig wlan0 0.0.0.0 sudo brctl addbr br0 sudo brctl addif br0 eth0 sudo brctl addif br0 wlan0 sudo dhclient br0 Note that not all Wi-fi devices will ...


2

! is a special bash character for history expansion and has to be escaped. The exclamation mark needs to be escaped in single quotes ' and the position is before the interface name, not before the argument. So your command becomes sudo iptables -t nat -A POSTROUTING -i '!'eth0 -o wlan+ -j MASQUERADE Note that POSTROUTING and -i don't work together, so it ...


2

For me: sudo ufw allow 9999 works, where 9999 is the port number i want to open. Debugging: In case ufw is not installed: sudo apt-get install ufw In case ufw is not running (check with sudo ufw status): sudo ufw enable Question already answered? i asked on meta: Should i place a second answer if question title vs answer differ?.


Only top voted, non community-wiki answers of a minimum length are eligible